{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-89749 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-89749 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-89749 and fix it if it is affected.\n\nWhat it is: CVE-2026-89749 is a vulnerability in Linux, published on 11 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-89749 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-89749/ (Markdown: https://insights.sbomify.com/CVE-2026-89749/index.md)","id":"CVE-2026-89749","markdown":"https://insights.sbomify.com/CVE-2026-89749/index.md","name":"CVE-2026-89749","record":{"aliases":["AZL-100491","BELL-CVE-2026-89749","DEBIAN-CVE-2026-89749","GHSA-hwhc-m4xq-f4r2","UBUNTU-CVE-2026-89749"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"none","summary":"A local attacker can trigger a kernel crash by inducing memory pressure during boot-time tracing self-tests, causing a null pointer dereference.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix crash passing ERR_PTR to kthread_stop()\n\nevent_test_stuff() calls kthread_run() and unconditionally passes the\nreturned task_struct pointer to kthread_stop(). kthread_run() returns an\nerror pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for\nexample under memory pressure during the boot-time event self-test.\nkthread_stop() then dereferences the invalid pointer, crashing the kernel.\n\nCheck the result of kthread_run() before passing it to kthread_stop(). Use\nWARN_ON() so that a failure to create the self-test thread does not go\nunnoticed, matching the ring-buffer self-test fix in commit\n91542863abad (\"ring-buffer: Fix crash passing ERR_PTR to kthread_stop()\").","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"tracing: Fix crash passing ERR_PTR to kthread_stop()","id":"CVE-2026-89749","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"tracing/user_events: Clear copied tracing state before fork duplication","id":"CVE-2026-89750"},"packages":[],"prev":{"headline":"tracing: Fix retry exhaustion in simple ring buffer reader swap","id":"CVE-2026-89748"},"products":["Linux"],"published":"2026-09-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A local attacker can trigger a kernel crash by inducing memory pressure during boot-time tracing self-tests, causing a null pointer dereference.","url":"https://insights.sbomify.com/CVE-2026-89749/"}